Hacks / Statistics / Q2 2022
Q2 2022 Exploit Report
April–June 2022: 22 reproduced exploits, $397M in stated losses.
22 exploits from April–June 2022 are reproduced in the library, 2 more than in Q1 2022. 15 of them state a dollar loss, $397M in total, against $769M the quarter before. Logic and Oracle Manipulation were the most common root-cause categories, on 9 incidents each. BNB Chain had the most incidents (11), while Ethereum carried the largest stated losses ($378M). The largest stated loss was Beanstalk Farms Exploit at $182M, 46% of the quarter's stated total.
Incidents
22
20 in Q1 2022.
Stated losses
$397M
15 of 22 incidents state a dollar figure. $769M in Q1 2022.
Largest stated loss
$182M
Beanstalk Farms Exploit
Most common root cause
Logic
On 9 of 22 incidents.
Root causes
How many of the quarter's incidents carry each category.
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 9 | $19.6M |
| Oracle Manipulation | 9 | $95.8M |
| Access Control | 8 | $104M |
| DeFi | 4 | $11.1M |
| Governance | 3 | $186M |
| Arithmetic | 1 | $10M |
| Denial of Service | 1 | — |
Chains
Where the exploited contracts were deployed.
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 11 | $18M |
| Ethereum | 9 | $378M |
| Base | 1 | — |
| Fantom | 1 | $1.3M |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Beanstalk Farms Exploit | Ethereum | $182M |
| Harmony Horizon Bridge Exploit | Ethereum | $100M |
| Rari Capital / Fei Protocol Fuse Exploit | Ethereum | $80M |
| Elephant Money Exploit | BNB Chain | $11M |
| Saddle Finance sUSD MetaPool Exploit | Ethereum | $10M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Beanstalk Farms ExploitFlash-Loan Governance Self-Pass | Apr 2022 | Ethereum | Governance | $182M |
| Harmony Horizon Bridge ExploitCompromised 2-of-5 Multisig Drains the Ethereum-Side Manager | Jun 2022 | Ethereum | Access Control | $100M |
| Rari Capital / Fei Protocol Fuse ExploitMis-Configured Collateral Oracle (USDC Priced Off the ETH/USD Chainlink Feed) | Apr 2022 | Ethereum | Oracle Manipulation | $80M |
| Elephant Money ExploitInfinite Mint via the Unverified Trunk Router (mint/redeem Accounting Flaw + Elephant Buy-Back Feedback) | Apr 2022 | BNB Chain | Logic | $11M |
| Saddle Finance sUSD MetaPool ExploitVirtual-Price Manipulation Round-Trip | Apr 2022 | Ethereum | Oracle Manipulation | $10M |
| XCarnival ExploitUntrusted xToken Argument in pledgeAndBorrow Lets Orders Borrow Against Already-Withdrawn Collateral | Jun 2022 | Ethereum | Logic | $3.9M |
| Fortress Loans ExploitGovernance Capture + Poisoned Umbrella Oracle → Over-borrow | May 2022 | BNB Chain | Governance | $3M |
| Gym Network LiquidityMigrationV2 ExploitMigration Contract Spends Its Own GYMNET to Mint LP for the Caller | Apr 2022 | BNB Chain | Logic | $2.1M |
| Gym Network SinglePool ExploitdepositFromOtherContract() Mints Stake Without Paying | Jun 2022 | BNB Chain | Logic | $1.5M |
| DEUS Finance DEI ExploitPrivileged Swapin Mint + DEI Collateral/LP Mispricing | Apr 2022 | Fantom | Access Control | $1.3M |
| Inverse Finance ExploitSpot-Balance Oracle Manipulation of the yvCurve-3Crypto Price Feed | Jun 2022 | Ethereum | Oracle Manipulation | $1.3M |
| BAYC / ApeCoin Airdrop ExploitERC-3156 Flash-Loan of Vaulted BAYC to Steal the APE Claim | May 2022 | Ethereum | Governance | $1M |
| Rikkei Finance ExploitPermissionless setOracleData() Oracle Hijack on a Compound-style Money Market | Apr 2022 | BNB Chain | Access Control | $270K |
| Zeed Finance ExploitReward-Fee Tri-Crediting Inflates YEED Pair Balances, Skim-Loop Drains USDT | Apr 2022 | BNB Chain | Logic | $112K |
| Discover / ETHpledge ExploitSelf-Referral Bonus Inflation via Spot-Price-Sourced Reward Math | Jun 2022 | BNB Chain | Oracle Manipulation | $20K |
| Aku-Auction (Akutar NFT) ExploitPush-Payment Refund DoS & Permanently Locked Funds | Apr 2022 | Ethereum | Denial of Service | not in dollars |
| CFToken ExploitExposed public _transfer Lets Anyone Drain the Pair's Tokens | Apr 2022 | BNB Chain | Access Control | not in dollars |
| HackDao ExploitFee-on-Transfer Token Listed in a Vanilla Pancake Pair (skim/sync reserve desync) | May 2022 | BNB Chain | Oracle Manipulation | not in dollars |
| NOVO ExploittransferFrom Skips Allowance Check, Pool Reserve Drained | May 2022 | BNB Chain | Logic | not in dollars |
| Optimism (Wintermute) ExploitUninitialized Gnosis Safe Proxy Front-Run | Jun 2022 | Base | Access Control | not in dollars |
| Snood (Schnoodle) ExploittransferFrom Allowance Bypass Drains the SNOOD/WETH Uniswap Pair | Jun 2022 | Ethereum | Logic | not in dollars |
| WDOGE (Wrapped Doge on BSC) ExploitReserves-Out-of-Sync Drain via Repeated skim/sync | Apr 2022 | BNB Chain | Oracle Manipulation | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.